The first field indicates the block address (minus 2) of a 1024 bytes block. The sum of first and the second fields indicates the block address (minus 5) of a 512 bytes block.

Block A

The A block contains many information about what looks like a decompression algorithm. This block is 1024 bytes long and is located at block blockA+2 (multiply this by 512 to get the offset). This block is XOR encoded using a key found in the block itself. The following procedure shows how to decode it. It uses a 1024 byte tables called g_check_block_A_table in the code below.

Booting sequence

On power on the CPU begin execution at VA=0xbfc00000 (PA=0x1fc00000) where BROM is mapped. BROM loads MBRCF*.BIN stored at the beginning of nand flash into iram (VA=0xb4040000, PA=0x14040000), check signature and checksum and passes control to the just loaded code. MBRCF* initializes caches, clocks, DRAM, loads BREC* loader to the DRAM (VA=0x80000000, PA=0x00000000) and passes control to the BREC. BREC checks logical structure of flash, loads and passes control to uCOS kernel. If at any stage of load chain en error is encountered 'Hard DFU' handler stored at 0xbfc05400 (0x1ffc bytes) in BROM is copied to 0xb4046800 and CPU jumps to this handler.